Shuriken Ransomware Will Encrypt Most Files
In the course of our examination of malicious samples, we came across a variant of ransomware identified as Shuriken. This specific type of ransomware not only encrypts files and modifies their names but also generates a ransom note titled "READ-ME-SHURKEWIN.txt." Additionally, Shuriken displays another ransom note before victims access the Windows operating system.
Shuriken modifies filenames by adding the email address decryption@msgsafe.io and the victim's ID to the beginning, along with appending the ".Shuriken" extension. For example, it transforms "1.jpg" into "[decryption@msgsafe.io][9ECFA84E]1.jpg.Shuriken," "2.png" into "[decryption@msgsafe.io][9ECFA84E]2.png.Shuriken," and so on.
Both ransom notes instruct the victim to reach out to the provided email address, decryption@msgsafe.io, for decryption. An alternative contact email, decryptor@waifu.club, is provided in case there is no response within 24 hours. Additionally, a Telegram contact, @ShurikenAdmin, is recommended for a swift decryption process.
The text file's note underscores the decryption assurance by allowing the victim to submit up to 2 test files for free decryption, with specific guidelines on file size, content, and compression methods.
Shuriken Ransom Note Promises Decryption of Two Files
The complete text of the Shuriken ransom note reads as follows:
Your data are encrypted …
All your files have been encrypted by Shuriken !!!
To decrypt them send e-mail to this address : decryption@msgsafe.io
If you do not receive a response within 24 hours, send an email to this address: decryptor@waifu.club
Need a quick decryption ? Send a telegram message @ShurikenAdminYour DECRYPTION ID : -
Enter the ID of your files in the subject!
What is our decryption guarantee?
Before paying you can send us up to 2 test files for free decryption !
The total size of files must be less than 2Mb.(non archived) !
Files should not contain valuable information.(databases,backups) !
Compress the file with zip or 7zip or rar compression programs and send it to us!
How Can Ransomware Infect Your System?
Ransomware can infiltrate your system through various means, and understanding these entry points is crucial for implementing effective cybersecurity measures. Here are common ways through which ransomware can infect your system:
Phishing Emails: Cybercriminals often use phishing emails to distribute ransomware. These emails may contain malicious attachments or links that, when clicked or opened, execute the ransomware on the victim's system. The emails may appear legitimate, often posing as invoices, job offers, or urgent messages to trick users into taking action.
Malicious Websites and Downloads: Visiting compromised or malicious websites can expose your system to ransomware. Some websites may host exploit kits that can automatically download and install ransomware on vulnerable systems. Illegitimate software downloads and pirated content are also common sources of ransomware infections.
Malvertising: Malicious advertising, or malvertising, involves cybercriminals placing malicious code in online advertisements. Clicking on these ads or visiting compromised websites hosting them can lead to ransomware infections.
Drive-By Downloads: Ransomware can be delivered through drive-by downloads, where malware is automatically downloaded and installed when a user visits a compromised or malicious website. This often occurs without the user's knowledge or consent.
Vulnerable Software: Exploiting vulnerabilities in outdated or unpatched software is a common method for ransomware attackers. It is crucial to keep your operating system, antivirus software, and all applications up to date with the latest security patches to reduce the risk of exploitation.
Social Engineering: Cybercriminals may use social engineering techniques to manipulate individuals into taking actions that facilitate ransomware infection. This can include tricking users into clicking on malicious links, downloading infected files, or disclosing sensitive information.
